URL Encoder / Decoder
Percent-encodes and decodes URL components in the browser using encodeURIComponent / decodeURIComponent (UTF-8; space becomes %20, not +). This is component encoding, not a full-URL encodeURI pass, not a URL validator, and not sanitizing or an XSS filter.
URL encode / decode
Client-side only. This is percent-encoding, not sanitizing, not an XSS filter, not a URL validator, and not security advice. Encoding does not make a URL safe. Nothing is sent to a server.
How to use
- Choose Encode (text → percent-encoding) or Decode (percent-encoding → text). Url encoder decoder online and url decoder online both live on this page.
- Paste text or a percent-encoded component. Read the result as text and copy it on this device. Invalid escape sequences fail closed.
- Nothing is sent to a server. Refreshing the page clears the form. This is encoding, not sanitizing.
Results
Paste text to percent-encode as a URL component.
Runs in your browser. Nothing is uploaded.
Frequently asked questions
Is this the page for url encoder decoder online and url decoder online?
Yes. This one URL, /url-encoder-decoder-online/, is the hub for url encoder decoder online and url decoder online. Encode and decode both run here. There is no /url-decoder-online/, /url-encoder-online/, /url-encoder-decoder/, or /review/url-encoder-decoder-online/ page.
Does this make a URL safe, or sanitize input?
No. This is percent-encoding, not sanitizing, not an XSS filter, not a URL validator, and not security advice. Encoding a string does not make a URL safe to open, embed, or trust. XSS-looking paste is encoded or decoded as text only.
What do encode and decode do here?
Encode uses encodeURIComponent semantics (UTF-8). Space becomes %20, not +. That is application/x-www-form-urlencoded component encoding of a single value, not a full-URL encodeURI pass, so reserved characters such as &, =, ?, and / are encoded. Decode uses decodeURIComponent. A plus sign stays a plus sign; it is not turned into a space.
What happens if the percent-encoding is invalid?
Invalid escape sequences fail closed with an error. Examples: a trailing % with no two hex digits (Hello%), non-hex digits such as %ZZ or %GG, or a truncated UTF-8 sequence such as %C3. The page does not drop, skip, or invent characters. Empty or whitespace-only paste also fails closed.
Is my text sent to a server?
No. Encode and decode run in your browser. There is no signup, no storage, and nothing is uploaded. Refreshing the page clears the form.
Is there a size limit?
Yes. Input larger than 100KB (100 × 1024 UTF-8 bytes) is rejected. Empty or whitespace-only input also fails closed. Nothing is sent to a server either way.